2020-09-30 23:30:40 +00:00
|
|
|
{ pkgs, config, lib, ... }: {
|
2021-05-18 13:56:39 +00:00
|
|
|
imports = [ ../../common ./admin.nix ../../cachix.nix ];
|
2018-02-08 22:16:23 +00:00
|
|
|
|
2020-10-04 14:24:18 +00:00
|
|
|
i18n.defaultLocale = "en_US.UTF-8";
|
2018-05-29 19:52:35 +00:00
|
|
|
|
2020-05-21 23:13:42 +00:00
|
|
|
# For nixos-rebuild
|
2020-12-16 18:26:20 +00:00
|
|
|
nixpkgs.overlays =
|
|
|
|
[ (_: _: (import ../../channels.nix).${config.networking.hostName}) ]
|
|
|
|
++ import ../../overlays { inherit lib; };
|
2020-05-21 23:13:42 +00:00
|
|
|
|
2019-08-02 17:03:36 +00:00
|
|
|
time.timeZone = "Europe/Berlin";
|
2018-02-08 22:55:24 +00:00
|
|
|
|
2019-08-02 17:03:36 +00:00
|
|
|
networking = {
|
|
|
|
firewall.allowPing = true;
|
|
|
|
useDHCP = false;
|
|
|
|
hosts = lib.zipAttrs
|
2021-02-02 09:08:53 +00:00
|
|
|
(
|
|
|
|
lib.mapAttrsToList (host: ip: { "${ip}" = "${host} ${host}.m-0.eu"; })
|
|
|
|
config.m-0.hosts
|
|
|
|
);
|
2019-08-02 17:03:36 +00:00
|
|
|
};
|
2018-02-08 22:16:23 +00:00
|
|
|
|
2020-04-26 15:38:32 +00:00
|
|
|
security.acme = {
|
|
|
|
email = "security@maralorn.de";
|
|
|
|
acceptTerms = true;
|
|
|
|
};
|
|
|
|
|
2020-10-01 05:10:28 +00:00
|
|
|
users = {
|
|
|
|
defaultUserShell = pkgs.zsh;
|
|
|
|
mutableUsers = false;
|
|
|
|
};
|
2019-02-22 00:45:45 +00:00
|
|
|
|
2019-08-02 17:03:36 +00:00
|
|
|
environment = {
|
2019-09-14 12:04:48 +00:00
|
|
|
etc = lib.mapAttrs'
|
|
|
|
(name: value: lib.nameValuePair "nix-path/${name}" { source = value; })
|
2020-05-21 23:13:42 +00:00
|
|
|
(lib.filterAttrs (name: value: name != "__functor") pkgs.sources) // {
|
2021-02-02 09:08:53 +00:00
|
|
|
"nix-path/nixos".source = pkgs.sources.${pkgs.nixpkgs-channel};
|
|
|
|
"nix-path/nixpkgs".source = pkgs.sources.${pkgs.nixpkgs-channel};
|
|
|
|
"nix-path/home-manager".source =
|
|
|
|
pkgs.sources.${pkgs.home-manager-channel};
|
|
|
|
};
|
2020-04-18 14:42:22 +00:00
|
|
|
variables =
|
|
|
|
lib.genAttrs [ "CURL_CA_BUNDLE" "GIT_SSL_CAINFO" "SSL_CERT_FILE" ]
|
2021-02-02 09:08:53 +00:00
|
|
|
(_: "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt");
|
2019-08-02 17:03:36 +00:00
|
|
|
};
|
2019-07-23 17:21:56 +00:00
|
|
|
|
2020-09-30 23:30:40 +00:00
|
|
|
system.activationScripts =
|
|
|
|
lib.mkIf (!pkgs.withSecrets) { text = "echo No secrets loaded!; exit 1;"; };
|
|
|
|
|
2019-08-02 17:03:36 +00:00
|
|
|
nix = {
|
2019-08-02 18:41:58 +00:00
|
|
|
binaryCaches =
|
2021-03-21 09:35:52 +00:00
|
|
|
[ "https://cache.nixos.org/" "https://nixcache.reflex-frp.org" "https://hydra.iohk.io" ];
|
2019-08-02 17:03:36 +00:00
|
|
|
binaryCachePublicKeys =
|
2021-03-21 09:35:52 +00:00
|
|
|
[
|
|
|
|
"ryantrinkle.com-1:JJiAKaRv9mWgpVAz8dwewnZe0AzzEAzPkagE9SP5NWI="
|
|
|
|
"hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ="
|
|
|
|
];
|
2020-05-27 13:20:08 +00:00
|
|
|
nixPath = [ "/etc/nix-path" ];
|
2021-01-09 04:49:17 +00:00
|
|
|
trustedUsers = [ "maralorn" "laminar" ];
|
2021-05-18 14:33:28 +00:00
|
|
|
buildMachines = pkgs.privateValue [ ] "remote-builders";
|
2019-08-12 10:54:55 +00:00
|
|
|
extraOptions = ''
|
|
|
|
fallback = true
|
|
|
|
keep-outputs = true
|
2020-09-30 23:30:40 +00:00
|
|
|
auto-optimise-store = true
|
|
|
|
builders-use-substitutes = true
|
2019-08-12 10:54:55 +00:00
|
|
|
'';
|
2021-01-30 22:24:32 +00:00
|
|
|
optimise = {
|
2021-05-18 14:33:28 +00:00
|
|
|
dates = [ ];
|
2021-01-30 22:24:32 +00:00
|
|
|
automatic = true;
|
|
|
|
};
|
2019-08-02 17:03:36 +00:00
|
|
|
};
|
2019-04-29 00:06:22 +00:00
|
|
|
|
2021-05-18 14:33:28 +00:00
|
|
|
systemd.services =
|
|
|
|
let
|
|
|
|
hosts = builtins.attrNames config.services.nginx.virtualHosts;
|
|
|
|
makeConfig = host: {
|
|
|
|
name = "acme-${host}";
|
|
|
|
value = {
|
|
|
|
serviceConfig = {
|
|
|
|
Restart = "on-failure";
|
|
|
|
RestartSec = 600;
|
|
|
|
};
|
|
|
|
unitConfig = {
|
|
|
|
StartLimitIntervalSec = 2400;
|
|
|
|
StartLimitBurst = 3;
|
|
|
|
};
|
2020-06-15 13:55:16 +00:00
|
|
|
};
|
|
|
|
};
|
2021-05-18 14:33:28 +00:00
|
|
|
in
|
2021-02-02 09:08:53 +00:00
|
|
|
{ nix-optimise.serviceConfig.Type = "oneshot"; } // builtins.listToAttrs (map makeConfig hosts);
|
2020-06-15 13:55:16 +00:00
|
|
|
|
2019-08-02 17:03:36 +00:00
|
|
|
services = {
|
2020-10-16 23:04:39 +00:00
|
|
|
journald.extraConfig = "SystemMaxUse=512M";
|
2019-08-02 17:03:36 +00:00
|
|
|
prometheus.exporters = {
|
|
|
|
node = {
|
|
|
|
enable = true;
|
|
|
|
enabledCollectors = [ "systemd" "logind" ];
|
|
|
|
disabledCollectors = [ "timex" ];
|
2019-03-07 23:37:39 +00:00
|
|
|
};
|
2019-02-22 00:45:45 +00:00
|
|
|
nginx = {
|
2019-08-02 17:03:36 +00:00
|
|
|
enable = config.services.nginx.enable;
|
|
|
|
openFirewall = true;
|
2019-02-22 00:45:45 +00:00
|
|
|
};
|
|
|
|
};
|
2019-08-02 17:03:36 +00:00
|
|
|
nginx = {
|
|
|
|
statusPage = true;
|
|
|
|
recommendedOptimisation = true;
|
|
|
|
recommendedGzipSettings = true;
|
|
|
|
recommendedTlsSettings = true;
|
2020-05-17 17:39:45 +00:00
|
|
|
clientMaxBodySize = "500m";
|
2020-10-17 13:59:50 +00:00
|
|
|
appendHttpConfig = "access_log off;";
|
2019-08-02 17:03:36 +00:00
|
|
|
};
|
2018-02-08 22:16:23 +00:00
|
|
|
};
|
2020-10-01 05:10:28 +00:00
|
|
|
programs = {
|
|
|
|
zsh = {
|
|
|
|
enable = true;
|
|
|
|
autosuggestions.enable = true;
|
|
|
|
enableCompletion = true;
|
|
|
|
syntaxHighlighting.enable = true;
|
|
|
|
};
|
|
|
|
};
|
2018-02-08 22:16:23 +00:00
|
|
|
}
|